We're still using them on machines where performance doesn't matter

On build machines, they're on a special VLAN and don't have endpoint protection, but they only download from a protected mirror